Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/08/2024, 09:50
General
-
Target
FACTURĂ.docx
-
Size
141KB
-
MD5
584410ce253da7a7a165233ca100ca83
-
SHA1
4be0e18e971f0c8443aba983826312f1a9103f0a
-
SHA256
773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5
-
SHA512
66555af131b8d9474bc3db81227b3ef4e74a7b3bc678b5715a54b52017d99f266729cbc2358425d09bcded014f6682633d30f2e1122a140faa54527c221348ae
-
SSDEEP
3072:nHjiNnE9xcCSbQcFyjZ9p7p6+1Ghfu+uUsw8Okcf:HedEFSbQ4gZ939Ou+uUsw7ki
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\FACTURĂ.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5767d8595d67d70f6c19ed869df119765
SHA18ceb76d98dde5e69bf541623ec5ac6f034e6edb8
SHA2568a05aef60aa3ca524164d3c1c0ac369a2b42d00293b33533cfce3d5576877ef8
SHA512794ce1be4440925efad4aa7823af3eca8b891109118a5e09414fc5a14e310db8af316d3e552ba22dac9bd0bd692f00955616cfdaec21c872f0a9377f3c61fc21
-
Filesize
92KB
MD57da751285a673c1b6b0459614a411267
SHA1a340c1b262b48dd4b1726fab58b304de0c258acd
SHA256ae69a637db88457f0e6f1b67e2f3b55b88bd95af602f4b1afe7dffc617593f2b
SHA512948e0702adbbd5424a8cda0b246d52f45b642745a39a04708527d0968b3481c181b380d86040200508ae77d4fcaeb9ea6745f8568b375425f5ff0d8ab82074d9
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
307B
MD50ea86afe4525144bba5257919f478b4a
SHA1bed37edbaaba9a52d7cf8d4fd6fd49432948895e
SHA256db1745243662a35b69abd8a69b7642aced1317f0e3274cea1a5e4bb4bd8e6a73
SHA51212e9d3d4cbc4fdedc03327d5bd17fb37a41c9b26c298e3cd7e3c120365dce9a93e0df9eaf7182f26e2322f223094cf141940c6432b643ecc7c0e350c276ba3dd
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
680B
MD5245b6647492f52540ddd98f62486bf75
SHA1bd9ae0942bf6684f03a1dc0d693d219513985061
SHA256a8ad72e26045d99a0753f112ba798d15260d2d16c86f16782a3eec4d39b97071
SHA512416b03b4ef3f02cfda5d33c0bd01f86e576cf5c1415304697640a67cae06e418e0f16edfbbc3f73930f5203700f5fbda63e287848c49b6e93ce5393954bfd4d0
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB